Security
CVE demonstrations
Public, reproducible exploit demonstrations with explicit evidence limits.
The public CVE corpus contains static evidence bundles for real CISA Known Exploited Vulnerabilities. Each entry includes a readable page, a machine-readable artifact contract, the normalized comparison report, reproduction commands, and SHA-256 checksums.
What the current results mean
Section titled “What the current results mean”The current entries reproduce the vulnerable behavior and exercise the same bounded probe against the comparison harness. They are non-certifying: tier 2 was not attempted because exported MVM attestations do not yet carry a real boot measurement and connected trusted hardware measurement.
No current entry claims that MVM contained the exploit. Every entry states the remaining risk, coverage gap, evidence tier, and why stronger evidence is not available. Fixing the vulnerable dependency remains required.
Verify and reproduce
Section titled “Verify and reproduce”Download an entry directory and verify its SHA256SUMS before inspecting the
files. The entry README.md gives the exact commands and source revision used
to reproduce it. The corpus is rebuilt on relevant input changes and at least
quarterly; each public update is reviewed in this repository before deployment.